scalix 1.3.2 → 1.4.0

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to Scalix Coder will be documented in this file.
 
+## [1.4.0] - 2026-07-05
+
+### Added
+- Scalix Cloud platform tools in the agent — your account's MCP catalog (`GET /api/v1/mcp`, scope-filtered per key) is fetched on start and registered as first-class function tools, executed via `POST /api/v1/mcp/call` with your own API key. Deploys, database queries, storage, functions and more become plain agent prompts
+- `/cloud` command — `/cloud status` (identity, plan, limits, tool count), `/cloud tools` (available `scalix_*` tools grouped by platform area), `/cloud refresh` (re-fetch identity + catalog)
+- `/login` command — links your Scalix account through the setup wizard
+- Connected onboarding — the setup wizard validates the API key against `GET /v1/me` and shows a "Connected to Scalix Cloud" panel (org, project, plan, rate limit, platform tools unlocked) with a re-enter/skip choice on failure; a "Try:" block with real platform prompts appears after a successful connect
+- Welcome/status line reflects the real connection: `☁ Scalix Cloud · <plan> · <N> platform tools` when connected, `☁ not connected — /login to link your Scalix account` otherwise
+- `SCALIX_PROJECT` env var — sent as `x-scalix-project` on catalog/tool calls to scope an org-wide key to one project
+
+### Changed
+- When the catalog is unreachable or no key is configured, the agent states it once and runs with local tools only — availability is never fabricated and there is no retry loop. Tool counts in the status bar and headless banner include only tools that actually loaded
+
+## [1.3.3] - 2026-07-05
+
+### Fixed
+- API endpoints aligned to the Scalix gateway's `/v1/ai` nest: chat completions now POST to `/v1/ai/chat/completions` and the model list is fetched from `GET /v1/ai/models` (OpenAI-style `{data: [...]}`). The default base URL is now the host root `https://api.scalix.world`; a trailing `/v1` in existing configs is still accepted and normalized
+- Voice input calls the single canonical `/v1/ai/audio/transcriptions` path and reports plainly when transcription isn't available on the deployment, instead of probing two dead endpoints
+- Web search no longer calls a non-existent platform research endpoint; it states that web research isn't available via the Scalix API yet and uses the configured search providers (Brave/Tavily/DuckDuckGo)
+- Sandbox no longer falsely blocks file access when the working directory sits behind a symlink (e.g. macOS temp dirs): symlink containment now compares real paths on both sides
+- `User-Agent` header carries the real package version instead of a hardcoded `1.0`
+
+### Changed
+- Model examples and defaults use current Scalix model names (`scalix-lumio-*`); the retired `scalix-world-ai` id removed from UI text and defaults
+- Model list UI no longer shows tier/provider columns (the API does not expose them)
+- README version badge matches the released package version
+
 ## [3.1.0] - 2026-04-20
 
 ### Added

package/README.md

@@ -2,11 +2,19 @@
 
 AI-powered coding agent for the terminal and VS Code — built by [Scalix World](https://scalix.world).
 
-![Version](https://img.shields.io/badge/version-1.0.0-blue)
+![Version](https://img.shields.io/badge/version-1.4.0-blue)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-green)
 ![License](https://img.shields.io/badge/license-EULA-orange)
 
-Scalix Coder is a full-featured AI coding assistant that runs in your terminal or as a VS Code extension. It connects to the Scalix API (or any OpenAI-compatible endpoint) and gives AI direct access to your codebase through 31 built-in tools — file editing, shell execution, search, git, web access, browser automation, vision, voice input, and more.
+Scalix Coder is a full-featured AI coding assistant that runs in your terminal or as a VS Code extension. It connects to the Scalix API (or your own compatible endpoint) and gives AI direct access to your codebase through 31 built-in tools — file editing, shell execution, search, git, web access, browser automation, vision, voice input, and more.
+
+## One agent for your whole cloud
+
+With a Scalix account, the agent is more than a coder: on start it fetches your account's platform tool catalog and registers every tool your API key's scopes unlock — databases, deployments (Scalix Run), storage, functions, cron, domains, and more. "Deploy this app", "create a table and seed it", "upload dist/ to a bucket" become plain prompts.
+
+- Tools reflect **your key's scopes** — the catalog is filtered server-side, and mutating tools are refused for read-only keys
+- `/cloud` shows your connection, plan, and available tools; `/cloud refresh` re-fetches the catalog
+- No account (or catalog unreachable)? The agent says so once and runs in **local-only mode** with the built-in tools — nothing is faked
 
 ## Features
 
@@ -55,6 +63,7 @@ First launch opens a setup wizard to configure your Scalix API key, endpoint, an
 | `SCALIX_API_KEY`  | API key (overrides saved config) |
 | `SCALIX_MODEL`    | Comma-separated model IDs        |
 | `SCALIX_BASE_URL` | API base URL                     |
+| `SCALIX_PROJECT`  | Project ID for org-wide keys (sent as `x-scalix-project` on platform tool calls) |
 | `BRAVE_API_KEY`   | Brave Search API key             |
 | `TAVILY_API_KEY`  | Tavily Search API key            |
 
@@ -90,6 +99,8 @@ scalix run "generate a migration" --output migration.sql --format patch
 | `/replay`          | Session timeline             |
 | `/plugins`         | Loaded plugins               |
 | `/settings`        | Configure limits             |
+| `/cloud`           | Scalix Cloud status, platform tools & refresh |
+| `/login`           | Link your Scalix account     |
 | `/setup`           | Reconfigure API key & models |
 | `/delegate <task>` | Run with sub-agent           |
 | `/checkpoint`      | Create git checkpoint        |

package/bin/scalix.js

@@ -8,6 +8,14 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 process.env.NODE_ENV = 'production';
 
 const args = process.argv.slice(2);
+
+if (args.includes('--version') || args.includes('-v')) {
+  const { readFileSync } = await import('node:fs');
+  const pkg = JSON.parse(readFileSync(resolve(__dirname, '..', 'package.json'), 'utf-8'));
+  console.log(pkg.version);
+  process.exit(0);
+}
+
 const needsHeadless =
   args.includes('run') ||
   args.includes('--pipe') || args.includes('-p') ||

package/dist/agent.js

@@ -3,7 +3,7 @@ import { EventEmitter } from 'eventemitter3';
 import { randomUUID } from 'node:crypto';
 import { getToolPermissionWithArgs } from './sandbox.js';
 import { logger } from './logger.js';
-import { DEFAULT_MODELS as FALLBACK_MODELS, DEFAULT_INSTRUCTIONS, AGENT_DEFAULTS, TOOL_DEFAULTS, BACKOFF_DEFAULTS, modelSupportsVision, getModelSpec } from './constants.js';
+import { DEFAULT_MODELS as FALLBACK_MODELS, DEFAULT_INSTRUCTIONS, DEFAULT_BASE_URL, AGENT_DEFAULTS, TOOL_DEFAULTS, BACKOFF_DEFAULTS, modelSupportsVision, getModelSpec } from './constants.js';
 import { estimateMessageTokens as estimateTokenCount } from './token-counter.js';
 import { ContextManager } from './context-manager.js';
 import { zodToJsonSchema } from './tool-helper.js';
@@ -19,8 +19,13 @@ import { extractCodeClaims, checkGrounding, formatGroundingNudge, GROUNDING_DEFA
 import { RETRIEVAL_DEFAULTS } from './context-retriever.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { fetchCloudTools, callCloudTool } from './cloud.js';
 function transformToolsForApi(tools) {
     return tools
+        // type:'mcp' entries are decorative config for user-registered external
+        // MCP servers and never reach the API. Scalix Cloud platform tools bypass
+        // this path entirely: they are plain function tools (CloudPlatformTool,
+        // registered by refreshCloudTools) whose `parameters` pass through as-is.
         .filter((t) => !('type' in t && t.type === 'mcp'))
         .map((t) => {
         const local = t;
@@ -158,12 +163,14 @@ export class Agent extends EventEmitter {
     retrievalConfig = null;
     _sending = false;
     outputFormatInstructionIndex = null;
+    cloudProjectId;
+    cloudStatus = { state: 'no-key', toolCount: 0 };
     constructor(config) {
         super();
         this.agentId = config.agentId ?? generateAgentId();
         this.parentAgentId = config.parentAgentId ?? null;
         this.agentDescription = config.agentDescription ?? 'main';
-        this.client = new ScalixClient(config.baseUrl || 'https://api.scalix.world/v1', config.apiKey);
+        this.client = new ScalixClient(config.baseUrl || DEFAULT_BASE_URL, config.apiKey);
         this.log = logger.child();
         const resolvedModels = Array.isArray(config.model)
             ? (config.model.length > 0 ? config.model : FALLBACK_MODELS)
@@ -189,6 +196,7 @@ export class Agent extends EventEmitter {
             thinkingMode: config.thinkingMode ?? 'off',
             workspaceRoot: config.workspaceRoot ?? process.cwd(),
         };
+        this.cloudProjectId = config.cloudProjectId ?? process.env.SCALIX_PROJECT ?? undefined;
         this.contextManager = new ContextManager(config.contextManager);
         if (config.dynamicToolSelection) {
             this.toolSelector = new ToolSelector();
@@ -422,6 +430,82 @@ export class Agent extends EventEmitter {
         if (this.toolSelector)
             this.toolSelector.index(this.config.tools);
     }
+    // ─── Scalix Cloud platform tools ───
+    isCloudTool(t) {
+        return 'source' in t && t.source === 'scalix-cloud';
+    }
+    /** Build a first-class function tool from a catalog entry. The server's JSON
+     *  Schema is passed to the model as-is via `parameters` (NOT `inputSchema`,
+     *  which transformToolsForApi would run through the Zod converter). */
+    makeCloudTool(ct) {
+        const baseUrl = this.client.baseURL;
+        const apiKey = this.config.apiKey;
+        const projectId = this.cloudProjectId;
+        return {
+            source: 'scalix-cloud',
+            name: ct.name,
+            description: ct.description,
+            parameters: ct.inputSchema,
+            execute: async (args) => {
+                const result = await callCloudTool(baseUrl, apiKey, ct.name, args ?? {}, projectId);
+                // Tool-level failures are tool results the model can react to, not
+                // exceptions — the "Error: " prefix is the model-facing signal.
+                return result.ok ? result.text : `Error: ${result.text}`;
+            },
+        };
+    }
+    /**
+     * Fetch the account's Scalix Cloud tool catalog and register every returned
+     * tool as a first-class function tool. Called on agent start and on demand
+     * (/cloud refresh). On failure the previously registered cloud tools are
+     * removed and the agent keeps running with local tools only — the returned
+     * status carries the real error for a single honest notice; no retries.
+     */
+    async refreshCloudTools() {
+        if (!this.config.apiKey) {
+            this.config.tools = this.config.tools.filter((t) => !this.isCloudTool(t));
+            this.cloudStatus = { state: 'no-key', toolCount: 0 };
+            return { ...this.cloudStatus };
+        }
+        try {
+            const catalog = await fetchCloudTools(this.client.baseURL, this.config.apiKey, this.cloudProjectId);
+            this.config.tools = this.config.tools.filter((t) => !this.isCloudTool(t));
+            const localNames = new Set(this.config.tools.map((t) => t.function?.name || t.name).filter(Boolean));
+            let registered = 0;
+            for (const ct of catalog.tools) {
+                if (localNames.has(ct.name)) {
+                    this.log.warn('Cloud tool name collides with a local tool — keeping the local tool', { tool: ct.name });
+                    continue;
+                }
+                this.config.tools.push(this.makeCloudTool(ct));
+                registered++;
+            }
+            if (this.toolSelector)
+                this.toolSelector.index(this.config.tools);
+            this.cloudStatus = {
+                state: 'connected',
+                toolCount: registered,
+                platformAvailable: catalog.platformAvailable,
+            };
+        }
+        catch (err) {
+            this.config.tools = this.config.tools.filter((t) => !this.isCloudTool(t));
+            if (this.toolSelector)
+                this.toolSelector.index(this.config.tools);
+            this.cloudStatus = { state: 'unavailable', toolCount: 0, error: err?.message || String(err) };
+            this.log.warn('Scalix Cloud tool catalog unavailable', { error: this.cloudStatus.error });
+        }
+        return { ...this.cloudStatus };
+    }
+    getCloudToolsStatus() {
+        return { ...this.cloudStatus };
+    }
+    getCloudTools() {
+        return this.config.tools.filter((t) => this.isCloudTool(t));
+    }
+    getCloudProjectId() {
+        return this.cloudProjectId;
+    }
     addModel(model) {
         if (!this.config.models.includes(model))
             this.config.models.push(model);
@@ -973,7 +1057,12 @@ export class Agent extends EventEmitter {
                         const execFn = tool?.function?.execute ?? tool?.execute;
                         if (tool && typeof execFn === 'function') {
                             try {
-                                const args = normalizeArgs(parsedArgs);
+                                // Cloud platform tools get the raw args: their JSON Schemas are
+                                // authoritative (snake_case) and the gateway validates them —
+                                // injecting camelCase duplicates could fail server-side validation.
+                                const args = tool?.source === 'scalix-cloud'
+                                    ? parsedArgs
+                                    : normalizeArgs(parsedArgs);
                                 reqLog.debug('Executing tool', { tool: call.name });
                                 const toolTimeout = (typeof args?.timeout === 'number' && args.timeout > 0)
                                     ? Math.min(args.timeout, TOOL_DEFAULTS.maxCommandTimeoutMs)

package/dist/api-client.js

@@ -1,3 +1,4 @@
+import { USER_AGENT, aiEndpointUrl } from './constants.js';
 export class ApiError extends Error {
     status;
     body;
@@ -19,7 +20,9 @@ export class ScalixClient {
         this.timeoutMs = timeoutMs;
     }
     async chatComplete(req, signal) {
-        const url = `${this.baseURL}/chat/completions`;
+        // baseURL is the API host root; the gateway nests AI under /v1/ai.
+        // aiEndpointUrl() also tolerates a legacy base ending in /v1.
+        const url = aiEndpointUrl(this.baseURL, 'chat/completions');
         const body = JSON.stringify(req);
         const timeoutSignal = AbortSignal.timeout(this.timeoutMs);
         const combined = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
@@ -28,7 +31,7 @@ export class ScalixClient {
             headers: {
                 'Content-Type': 'application/json',
                 'Authorization': `Bearer ${this.apiKey}`,
-                'User-Agent': 'Scalix-Coder/1.0',
+                'User-Agent': USER_AGENT,
             },
             body,
             signal: combined,

package/dist/cli.js

@@ -45,6 +45,7 @@ import { createWorktree, listWorktrees, removeWorktree, cleanupStaleWorktrees }
 import { sendNotification, getTerminalType } from './terminal-notify.js';
 import { stringWidth, truncateText } from './text-utils.js';
 import { isWorkspaceTrusted, trustWorkspace, hasProjectExecSurface } from './workspace-trust.js';
+import { fetchMe, fetchCloudTools, groupCloudTools, CONSOLE_KEYS_URL } from './cloud.js';
 logger.setLevel('silent');
 // Promisified async child_process helpers (keep the TUI responsive vs execSync).
 const execFileAsync = promisify(execFile);
@@ -92,6 +93,11 @@ console.error = (...args) => {
 // sanitizeInput) and buffer the pasted content into the input value instead of
 // treating each embedded newline as a separate Enter (which caused many submits).
 process.stdout.write('\x1b[?2004h');
+// User-registered external MCP servers (mcp-services.json). These are
+// decorative config entries only — they are filtered out of API requests by
+// transformToolsForApi. Scalix Cloud platform tools do NOT use this path: they
+// are fetched from the account's catalog and registered as first-class
+// function tools via agent.refreshCloudTools() (see connectCloud below).
 const mcpTools = loadMcpServices();
 let pluginTools = [];
 const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools];
@@ -139,6 +145,48 @@ let loadedSkills = [];
 // exec surface (plugins/hooks/rules/settings) that we skipped loading. The App
 // reads this on mount to inform the user they can run /trust to enable them.
 let workspaceUntrustedNotice = false;
+let cloudConnection = { connected: false, identity: null, toolCount: 0 };
+// Set by the setup wizard when its Scalix Cloud validation step succeeded, so
+// the App shows the "Try:" teach-in exactly once after a wizard or /login
+// connect (not on every ordinary startup reconnect).
+let cloudTeachInPending = false;
+// Validate the key against /v1/me, then fetch the account's tool catalog and
+// register it on the agent. One attempt, no retry loop: failure leaves the
+// agent with local tools only and carries the server's own error message.
+async function connectCloud(targetAgent) {
+    if (!targetAgent.getApiKey()) {
+        cloudConnection = { connected: false, identity: null, toolCount: 0, error: 'no API key configured' };
+        return cloudConnection;
+    }
+    try {
+        const identity = await fetchMe(targetAgent.getBaseUrl() || DEFAULT_BASE_URL, targetAgent.getApiKey());
+        const status = await targetAgent.refreshCloudTools();
+        if (status.state === 'connected') {
+            cloudConnection = { connected: true, identity, toolCount: status.toolCount };
+        }
+        else {
+            cloudConnection = { connected: false, identity, toolCount: 0, error: status.error };
+        }
+    }
+    catch (err) {
+        // /v1/me failed. Run the catalog fetch anyway: on failure it clears any
+        // stale platform tools from a previous connect; in the rare case it
+        // succeeds, the tools genuinely work and we say so (identity unavailable).
+        const status = await targetAgent.refreshCloudTools().catch(() => null);
+        if (status?.state === 'connected') {
+            cloudConnection = { connected: true, identity: null, toolCount: status.toolCount, error: err?.message || String(err) };
+        }
+        else {
+            cloudConnection = { connected: false, identity: null, toolCount: 0, error: err?.message || String(err) };
+        }
+    }
+    return cloudConnection;
+}
+const CLOUD_TRY_PROMPTS = [
+    'deploy this app to Scalix Run',
+    'create a table in my Scalix database and insert seed data',
+    'list my storage buckets and upload dist/ to one',
+];
 // Discover and register project-local plugin tools for the given agent.
 // Gated on workspace trust; reused by initAgent and the /trust command.
 function discoverPluginsForAgent(targetAgent) {
@@ -403,7 +451,7 @@ function formatContextSize(tokens) {
     return String(tokens);
 }
 function SetupScreen({ onComplete, existingConfig }) {
-    const STEPS = ['api-key', 'base-url', 'models', 'context-window'];
+    const STEPS = ['api-key', 'base-url', 'cloud', 'models', 'context-window'];
     const [step, setStep] = useState('api-key');
     const [apiKey, setApiKey] = useState(existingConfig?.apiKey || process.env[ENV_API_KEY] || '');
     const [baseUrl, setBaseUrl] = useState(existingConfig?.baseUrl || DEFAULT_BASE_URL);
@@ -414,7 +462,33 @@ function SetupScreen({ onComplete, existingConfig }) {
     const [apiKeyError, setApiKeyError] = useState(false);
     const [fetchedModels, setFetchedModels] = useState([]);
     const [fetchingModels, setFetchingModels] = useState(false);
+    const [cloudCheck, setCloudCheck] = useState({ phase: 'checking' });
     const { exit } = useApp();
+    // Validate the key against Scalix Cloud when the cloud step is entered:
+    // /v1/me for identity/plan, then the tool catalog for the unlocked count.
+    useEffect(() => {
+        if (step !== 'cloud')
+            return;
+        let cancelled = false;
+        setCloudCheck({ phase: 'checking' });
+        (async () => {
+            const identity = await fetchMe(baseUrl, apiKey);
+            const catalog = await fetchCloudTools(baseUrl, apiKey, process.env.SCALIX_PROJECT);
+            return { identity, toolCount: catalog.tools.length };
+        })().then((result) => {
+            if (cancelled)
+                return;
+            cloudTeachInPending = true;
+            setCloudCheck({ phase: 'ok', identity: result.identity, toolCount: result.toolCount });
+        }).catch((err) => {
+            if (cancelled)
+                return;
+            setCloudCheck({ phase: 'fail', error: err?.message || String(err) });
+        });
+        return () => { cancelled = true; };
+        // apiKey/baseUrl are intentionally not deps: they are frozen once the user
+        // advances past base-url, and the step transition is the trigger.
+    }, [step]);
     const totalSteps = STEPS.length;
     const stepNumber = STEPS.indexOf(step) + 1;
     const goBack = useCallback(() => {
@@ -453,6 +527,8 @@ function SetupScreen({ onComplete, existingConfig }) {
                                         }, placeholder: "sk-or-v1-..." })] }), apiKeyError && (_jsx(Box, { marginTop: 0, paddingLeft: 2, children: _jsx(Text, { color: "yellow", dimColor: true, children: "API key is required." }) }))] })), step === 'base-url' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Base URL" }), _jsx(Text, { dimColor: true, children: "Scalix API endpoint (or any compatible URL)" }), _jsxs(Box, { marginTop: 1, children: [_jsxs(Text, { color: "#20a0a0", bold: true, children: ['\u276F', " "] }), _jsx(TextInput, { value: baseUrl, onChange: (v) => setBaseUrl(sanitizeInput(v)), onSubmit: (v) => {
                                             const url = sanitizeInput(v).trim() || baseUrl;
                                             setBaseUrl(url);
+                                            // Model list loads in the background while the cloud step
+                                            // validates the key via /v1/me + the tool catalog.
                                             setFetchingModels(true);
                                             fetchModelSpecs(url, apiKey).then((result) => {
                                                 if (result.length > 0) {
@@ -460,9 +536,19 @@ function SetupScreen({ onComplete, existingConfig }) {
                                                 }
                                             }).catch((err) => { logger.warn('Failed to fetch model specs', { error: err.message }); }).finally(() => {
                                                 setFetchingModels(false);
-                                                setStep('models');
                                             });
-                                        }, placeholder: DEFAULT_BASE_URL })] }), fetchingModels && (_jsx(Box, { paddingLeft: 2, marginTop: 1, children: _jsx(Text, { color: "#20a0a0", dimColor: true, children: "Fetching available models..." }) }))] })), step === 'models' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Models" }), fetchedModels.length > 0 && modelsMode === 'custom' && models.length === 0 ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Select models from your API or type a custom model ID." }), _jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(SelectInput, { items: [
+                                            setStep('cloud');
+                                        }, placeholder: DEFAULT_BASE_URL })] }), fetchingModels && (_jsx(Box, { paddingLeft: 2, marginTop: 1, children: _jsx(Text, { color: "#20a0a0", dimColor: true, children: "Fetching available models..." }) }))] })), step === 'cloud' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Scalix Cloud" }), cloudCheck.phase === 'checking' && (_jsxs(Box, { marginTop: 1, gap: 1, children: [_jsx(Text, { color: "#20a0a0", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { dimColor: true, children: "Validating your API key with Scalix Cloud..." })] })), cloudCheck.phase === 'ok' && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "#30c090", paddingX: 2, marginTop: 1, alignSelf: "flex-start", children: [_jsxs(Text, { color: "#30c090", bold: true, children: ['✓', " Connected to Scalix Cloud"] }), _jsxs(Text, { children: ["Org:        ", _jsx(Text, { color: "#20a0a0", children: cloudCheck.identity.identity.orgId })] }), _jsxs(Text, { children: ["Project:    ", _jsx(Text, { color: "#20a0a0", children: cloudCheck.identity.identity.projectId || 'org-wide' })] }), _jsxs(Text, { children: ["Plan:       ", _jsx(Text, { color: "#20a0a0", children: cloudCheck.identity.limits.plan })] }), _jsxs(Text, { children: ["Rate limit: ", _jsxs(Text, { color: "#20a0a0", children: [cloudCheck.identity.limits.rateLimitRps, " req/s"] })] }), _jsxs(Text, { color: "#30c090", bold: true, children: ['●', " ", cloudCheck.toolCount, " platform tools unlocked"] })] }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [{ label: '→ Continue', value: '__continue__' }], onSelect: () => setStep('models') }) })] })), cloudCheck.phase === 'fail' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "red", children: ['✘', " ", cloudCheck.error] }) }), _jsxs(Text, { dimColor: true, children: ["Create or check your key at ", CONSOLE_KEYS_URL] }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [
+                                                { label: 'Re-enter API key', value: '__reenter__' },
+                                                { label: 'Skip — continue without Scalix Cloud (local tools only)', value: '__skip__' },
+                                            ], onSelect: (item) => {
+                                                if (item.value === '__reenter__') {
+                                                    setStep('api-key');
+                                                }
+                                                else {
+                                                    setStep('models');
+                                                }
+                                            } }) })] }))] })), step === 'models' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Models" }), fetchedModels.length > 0 && modelsMode === 'custom' && models.length === 0 ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Select models from your API or type a custom model ID." }), _jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(SelectInput, { items: [
                                                 ...fetchedModels.filter((fm) => !models.includes(fm.id)).map((fm) => ({
                                                     label: `  ${fm.name || fm.id}`,
                                                     value: fm.id,
@@ -587,8 +673,8 @@ const StatusBar = memo(function StatusBar({ status, model, toolCount, thinkStart
     const gap = Math.max(cols - leftText.length - rightLen - 8, 2);
     return (_jsxs(Box, { paddingX: 2, children: [_jsxs(Box, { gap: 1, children: [_jsx(Text, { color: statusColor, children: statusIcon }), _jsx(Text, { dimColor: true, children: leftText })] }), _jsx(Text, { children: ' '.repeat(gap) }), _jsxs(Box, { gap: 1, children: [rateLimitWarn && _jsxs(Text, { color: "red", bold: true, children: ['\u26A0', " Rate limited"] }), _jsx(Text, { color: modeColor, bold: true, children: mode }), elapsedStr ? _jsxs(Text, { dimColor: true, children: ['\u00B7', " ", elapsedStr] }) : null, _jsxs(Text, { dimColor: true, children: ['\u00B7', " v", VERSION] })] })] }));
 });
-const WelcomeScreen = memo(function WelcomeScreen() {
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 2, paddingY: 0, children: [_jsx(Text, { dimColor: true, children: "  Type a message or use /help for commands. Press Esc to exit." }), _jsxs(Box, { marginTop: 0, paddingLeft: 2, gap: 1, flexWrap: "wrap", children: [_jsx(Text, { dimColor: true, children: "Tools:" }), ['shell', 'read', 'write', 'edit', 'search', 'find', 'git', 'web', 'tree'].map((t) => (_jsx(Text, { dimColor: true, bold: true, children: t }, t)))] })] }));
+const WelcomeScreen = memo(function WelcomeScreen({ cloud }) {
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 2, paddingY: 0, children: [_jsx(Text, { dimColor: true, children: "  Type a message or use /help for commands. Press Esc to exit." }), _jsxs(Box, { marginTop: 0, paddingLeft: 2, gap: 1, flexWrap: "wrap", children: [_jsx(Text, { dimColor: true, children: "Tools:" }), ['shell', 'read', 'write', 'edit', 'search', 'find', 'git', 'web', 'tree'].map((t) => (_jsx(Text, { dimColor: true, bold: true, children: t }, t)))] }), _jsx(Box, { paddingLeft: 2, children: cloud.connected ? (_jsxs(Text, { color: "#20a0a0", children: ['☁', " Scalix Cloud ", '·', " ", cloud.identity ? `${cloud.identity.limits.plan} ${'·'} ` : '', cloud.toolCount, " platform tools"] })) : (_jsxs(Text, { dimColor: true, children: ['☁', " not connected ", '—', " /login to link your Scalix account"] })) })] }));
 });
 const UserMessage = memo(function UserMessage({ text }) {
     return (_jsxs(Box, { paddingX: 2, marginTop: 1, gap: 1, children: [_jsx(Text, { color: "magentaBright", bold: true, children: '\u276F' }), _jsx(Text, { wrap: "wrap", bold: true, children: text })] }));
@@ -1251,6 +1337,8 @@ const InputSection = memo(function InputSection({ onSubmit, disabled, onAbort, o
         { cmd: '/status', desc: 'Version, model & connection info' },
         { cmd: '/doctor', desc: 'Diagnose installation' },
         { cmd: '/mcp', desc: 'Add MCP server' },
+        { cmd: '/cloud', desc: 'Scalix Cloud status, platform tools & refresh' },
+        { cmd: '/login', desc: 'Link your Scalix account (API key)' },
         { cmd: '/setup', desc: 'Reconfigure API key, URL & models' },
         { cmd: '/settings', desc: 'View & configure limits' },
         { cmd: '/permissions', desc: 'View permission rules & recent denials' },
@@ -1428,6 +1516,7 @@ function App({ config }) {
     const [selectingMode, setSelectingMode] = useState(false);
     const [editingSettings, setEditingSettings] = useState(false);
     const [agentVersion, setAgentVersion] = useState(0);
+    const [cloudInfo, setCloudInfo] = useState(cloudConnection);
     const counter = useRef(0);
     const showBannerRef = useRef(true);
     const modelsRef = useRef(models);
@@ -1687,6 +1776,34 @@ function App({ config }) {
             add('system', 'This workspace has project plugins/hooks/rules that were skipped because the workspace is not trusted. Run /trust to load them.');
         }
     }, [add]);
+    // Scalix Cloud: on agent start (and after /setup or /login re-init), fetch
+    // the account's tool catalog and register it. Failure or no key → local
+    // tools only, with exactly one honest notice. No retry loop.
+    useEffect(() => {
+        if (!agent)
+            return;
+        const hasKey = !!agent.getApiKey();
+        let cancelled = false;
+        connectCloud(agent).then((state) => {
+            if (cancelled)
+                return;
+            setCloudInfo({ ...state });
+            if (state.connected) {
+                // Teach-in: only right after a wizard or /login connect, and only
+                // when tools actually loaded.
+                if (cloudTeachInPending && state.toolCount > 0) {
+                    cloudTeachInPending = false;
+                    const plan = state.identity ? ` ${'·'} ${state.identity.limits.plan}` : '';
+                    add('system', `☁ Connected to Scalix Cloud${plan} ${'·'} ${state.toolCount} platform tools`);
+                    add('system', `Try:\n${CLOUD_TRY_PROMPTS.map((p) => `  ❯ ${p}`).join('\n')}`);
+                }
+            }
+            else if (hasKey) {
+                add('system', `☁ Scalix Cloud unavailable — running with local tools only. ${state.error ?? ''}`.trimEnd());
+            }
+        });
+        return () => { cancelled = true; };
+    }, [add, agentVersion]);
     // Idle session nudge: suggest /clear after 75+ minutes of inactivity
     const lastActivityRef = useRef(Date.now());
     const idleNudgedRef = useRef(false);
@@ -1804,6 +1921,8 @@ function App({ config }) {
                 '',
                 'Tools & Config:',
                 '  /copy         \u2014 copy last response to clipboard',
+                '  /cloud        \u2014 Scalix Cloud status (/cloud tools, /cloud refresh)',
+                '  /login        \u2014 link your Scalix account (API key)',
                 '  /status       \u2014 show version, model & connection info',
                 '  /update       \u2014 check for and install updates',
                 '  /doctor       \u2014 diagnose installation',
@@ -2027,6 +2146,68 @@ function App({ config }) {
             setShowSetup(true);
             return true;
         }
+        if (cmd === '/login') {
+            // Key (re-)entry runs through the setup wizard, whose cloud step
+            // performs the same fetchMe + catalog validation as first-run setup.
+            setShowSetup(true);
+            return true;
+        }
+        if (cmd === '/cloud') {
+            const sub = text.split(' ')[1]?.toLowerCase() || 'status';
+            if (sub === 'status') {
+                const s = cloudConnection;
+                if (s.connected) {
+                    add('system', `☁ Scalix Cloud ${'—'} connected`);
+                    if (s.identity) {
+                        add('system', `Org: ${s.identity.identity.orgId}`);
+                        add('system', `Project: ${s.identity.identity.projectId || agent.getCloudProjectId() || 'org-wide'}`);
+                        add('system', `Key: ${s.identity.identity.keyId} (${s.identity.permissions.role})`);
+                        add('system', `Plan: ${s.identity.limits.plan} ${'·'} ${s.identity.limits.rateLimitRps} req/s ${'·'} ${s.identity.limits.apiKeysMax} API keys max`);
+                        add('system', `Scopes: ${s.identity.permissions.scopes.join(', ') || 'none'}`);
+                    }
+                    else {
+                        add('system', `Identity unavailable: ${s.error ?? 'unknown error'}`);
+                    }
+                    add('system', `Platform tools: ${s.toolCount} registered ${'—'} /cloud tools to list them`);
+                }
+                else {
+                    add('system', `☁ not connected ${'—'} /login to link your Scalix account`);
+                    if (s.error)
+                        add('system', `Last error: ${s.error}`);
+                }
+                return true;
+            }
+            if (sub === 'tools') {
+                const tools = agent.getCloudTools();
+                if (tools.length === 0) {
+                    add('system', cloudConnection.connected
+                        ? 'No platform tools are registered for this key (its scopes unlock none).'
+                        : `☁ not connected ${'—'} /login to link your Scalix account`);
+                    return true;
+                }
+                add('system', `Platform tools (${tools.length}):`);
+                for (const [group, groupTools] of groupCloudTools(tools)) {
+                    add('system', `  ${group} (${groupTools.length}): ${groupTools.map((t) => t.name).join(', ')}`);
+                }
+                return true;
+            }
+            if (sub === 'refresh') {
+                add('system', 'Refreshing Scalix Cloud connection...');
+                connectCloud(agent).then((state) => {
+                    setCloudInfo({ ...state });
+                    if (state.connected) {
+                        const plan = state.identity ? `${state.identity.limits.plan} plan ${'·'} ` : '';
+                        add('system', `☁ Connected ${'—'} ${plan}${state.toolCount} platform tools`);
+                    }
+                    else {
+                        add('error', `☁ Scalix Cloud unavailable: ${state.error ?? 'unknown error'}`);
+                    }
+                });
+                return true;
+            }
+            add('system', 'Usage: /cloud [status|tools|refresh]');
+            return true;
+        }
         if (cmd === '/mode') {
             const arg = text.split(' ')[1]?.toLowerCase();
             if (arg && PERMISSION_MODES.includes(arg)) {
@@ -2626,6 +2807,9 @@ function App({ config }) {
             add('system', `${PRODUCT_NAME} v${VERSION}`);
             add('system', `Model: ${modelsStr}`);
             add('system', `API: ${baseUrl}`);
+            add('system', cloudConnection.connected
+                ? `Cloud: ☁ Scalix Cloud ${'·'} ${cloudConnection.identity ? `${cloudConnection.identity.limits.plan} ${'·'} ` : ''}${cloudConnection.toolCount} platform tools`
+                : `Cloud: ☁ not connected ${'—'} /login to link your Scalix account`);
             add('system', `Mode: ${mode}`);
             add('system', `Context: ${ctx.percentage}% (${formatTokens(ctx.tokens)} / ${formatTokens(ctx.maxTokens)})`);
             add('system', `Messages: ${msgCount}`);
@@ -3060,7 +3244,7 @@ function App({ config }) {
     if (showSetup) {
         return _jsx(SetupScreen, { onComplete: handleSetupDone, existingConfig: config });
     }
-    return (_jsxs(Box, { flexDirection: "column", width: "100%", height: rows, children: [showBanner && _jsx(Banner, {}), _jsx(StatusBar, { status: status, model: models[0] || 'no model', toolCount: allTools.length + pluginTools.length, thinkStart: thinkStart, tokens: totalTokens, mode: currentMode, contextPercent: contextPercent, rateLimitWarn: rateLimitWarn }), _jsxs(Box, { flexDirection: "column", flexGrow: 1, flexShrink: 1, minHeight: 6, overflowY: "hidden", children: [showBanner && !isLoading && _jsx(WelcomeScreen, {}), !isAtTop && !showBanner && (_jsx(Box, { justifyContent: "center", children: _jsxs(Text, { dimColor: true, children: [" ", '\u2191', " more above ", '\u2014', " Shift+Up "] }) })), visibleItems.map((item) => _jsx(RenderItem, { item: item }, item.id)), isLoading && _jsx(StreamingArea, { text: streamText, reasoning: reasoningText, model: shortModel(models[0] || '') }), !isAtBottom && (_jsx(Box, { justifyContent: "center", children: _jsxs(Text, { dimColor: true, children: [" ", '\u2193', " more below ", '\u2014', " Shift+Down "] }) }))] }), _jsx(Box, { flexShrink: 0, flexDirection: "column", children: confirmInfo ? (_jsx(ConfirmPrompt, { toolName: confirmInfo.toolName, args: confirmInfo.args, onRespond: handleConfirm, onScrollUp: scrollUp, onScrollDown: scrollDown })) : selectingModel ? (_jsx(ModelPicker, { currentModels: models, onSelect: (v) => {
+    return (_jsxs(Box, { flexDirection: "column", width: "100%", height: rows, children: [showBanner && _jsx(Banner, {}), _jsx(StatusBar, { status: status, model: models[0] || 'no model', toolCount: allTools.length + pluginTools.length + cloudInfo.toolCount, thinkStart: thinkStart, tokens: totalTokens, mode: currentMode, contextPercent: contextPercent, rateLimitWarn: rateLimitWarn }), _jsxs(Box, { flexDirection: "column", flexGrow: 1, flexShrink: 1, minHeight: 6, overflowY: "hidden", children: [showBanner && !isLoading && _jsx(WelcomeScreen, { cloud: cloudInfo }), !isAtTop && !showBanner && (_jsx(Box, { justifyContent: "center", children: _jsxs(Text, { dimColor: true, children: [" ", '\u2191', " more above ", '\u2014', " Shift+Up "] }) })), visibleItems.map((item) => _jsx(RenderItem, { item: item }, item.id)), isLoading && _jsx(StreamingArea, { text: streamText, reasoning: reasoningText, model: shortModel(models[0] || '') }), !isAtBottom && (_jsx(Box, { justifyContent: "center", children: _jsxs(Text, { dimColor: true, children: [" ", '\u2193', " more below ", '\u2014', " Shift+Down "] }) }))] }), _jsx(Box, { flexShrink: 0, flexDirection: "column", children: confirmInfo ? (_jsx(ConfirmPrompt, { toolName: confirmInfo.toolName, args: confirmInfo.args, onRespond: handleConfirm, onScrollUp: scrollUp, onScrollDown: scrollDown })) : selectingModel ? (_jsx(ModelPicker, { currentModels: models, onSelect: (v) => {
                         agent.setModel(v);
                         setModels([v]);
                         setSelectingModel(false);

package/dist/cloud.js

@@ -0,0 +1,236 @@
+// Scalix Cloud platform client — identity (/v1/me), the account's MCP tool
+// catalog (/api/v1/mcp), and tool execution (/api/v1/mcp/call).
+//
+// Wire-format notes (verified against the gateway + mcp-server crates):
+// - Catalog tool entries serialize the schema under `input_schema` (snake_case,
+//   serde default on McpToolDef in both crates/gateway/src/mcp.rs and
+//   crates/mcp-server/src/types.rs). The MCP JSON-RPC spec spells it
+//   `inputSchema`; we tolerate both so a future spec-aligned rename is a no-op.
+// - Tool call results are `{content: [{type: 'text', text}], is_error}`
+//   (McpToolResult/McpContent — only text blocks are ever produced). `isError`
+//   is tolerated for the same forward-compat reason.
+// - Error envelope on 4xx/5xx: `{error, code, request_id?, docs_url?}`
+//   (ApiError::into_response in crates/gateway/src/server.rs).
+//
+// Dependency-free: global fetch only. Reuses apiHostRoot() so legacy configs
+// with a trailing /v1 keep working for these non-AI endpoints too.
+import { apiHostRoot, USER_AGENT, WEB_DEFAULTS } from './constants.js';
+export const CONSOLE_KEYS_URL = 'https://console.scalix.world/org/keys';
+export const CLOUD_DEFAULTS = {
+    fetchTimeoutMs: WEB_DEFAULTS.apiFetchTimeoutMs,
+    // Platform operations (deploys, migrations) can legitimately take a while.
+    callTimeoutMs: 120_000,
+};
+export class CloudError extends Error {
+    status;
+    code;
+    docsUrl;
+    requestId;
+    constructor(message, opts = {}) {
+        super(message);
+        this.name = 'CloudError';
+        this.status = opts.status;
+        this.code = opts.code;
+        this.docsUrl = opts.docsUrl;
+        this.requestId = opts.requestId;
+    }
+}
+// ─── Pure parsers (unit-tested without network) ───
+/**
+ * Build a CloudError from a non-OK response body using the gateway's error
+ * envelope `{error, code, docs_url, request_id}`. Falls back to the raw body
+ * (or status text) when the body isn't the envelope — the message is always
+ * whatever the server actually said, never an invented one.
+ */
+export function errorFromEnvelope(status, statusText, bodyText) {
+    let envelope = null;
+    try {
+        const parsed = JSON.parse(bodyText);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+            envelope = parsed;
+    }
+    catch { }
+    if (status === 401) {
+        return new CloudError(`API key rejected — create one at ${CONSOLE_KEYS_URL}`, {
+            status,
+            code: typeof envelope?.code === 'string' ? envelope.code : undefined,
+            docsUrl: typeof envelope?.docs_url === 'string' ? envelope.docs_url : undefined,
+            requestId: typeof envelope?.request_id === 'string' ? envelope.request_id : undefined,
+        });
+    }
+    const message = typeof envelope?.error === 'string' && envelope.error
+        ? envelope.error
+        : (bodyText.trim().slice(0, 200) || `${status} ${statusText}`);
+    return new CloudError(message, {
+        status,
+        code: typeof envelope?.code === 'string' ? envelope.code : undefined,
+        docsUrl: typeof envelope?.docs_url === 'string' ? envelope.docs_url : undefined,
+        requestId: typeof envelope?.request_id === 'string' ? envelope.request_id : undefined,
+    });
+}
+/** Parse the `GET /v1/me` response. Throws CloudError on a malformed body. */
+export function parseMeResponse(data) {
+    const d = data;
+    const identity = d?.identity;
+    const permissions = d?.permissions;
+    const limits = d?.limits;
+    if (!identity || typeof identity.org_id !== 'string'
+        || !permissions || !Array.isArray(permissions.scopes)
+        || !limits || typeof limits.plan !== 'string') {
+        throw new CloudError('Unexpected /v1/me response shape — the endpoint did not return identity/permissions/limits');
+    }
+    return {
+        identity: {
+            keyId: String(identity.key_id ?? ''),
+            tokenType: String(identity.token_type ?? ''),
+            orgId: identity.org_id,
+            projectId: typeof identity.project_id === 'string' && identity.project_id ? identity.project_id : undefined,
+            createdBy: String(identity.created_by ?? ''),
+        },
+        permissions: {
+            role: String(permissions.role ?? ''),
+            scopes: permissions.scopes.filter((s) => typeof s === 'string'),
+            canCreateKeys: permissions.can_create_keys === true,
+            canCreateProjects: permissions.can_create_projects === true,
+        },
+        tools: Array.isArray(d.tools) ? d.tools.filter((t) => typeof t === 'string') : [],
+        limits: {
+            plan: limits.plan,
+            rateLimitRps: typeof limits.rate_limit_rps === 'number' ? limits.rate_limit_rps : 0,
+            apiKeysMax: typeof limits.api_keys_max === 'number' ? limits.api_keys_max : 0,
+        },
+    };
+}
+/**
+ * Parse the `GET /api/v1/mcp` catalog. Entries without a name or an object
+ * schema are dropped (the gateway guarantees both; we don't register a tool we
+ * can't describe to the model). Throws CloudError when the body isn't a catalog.
+ */
+export function parseCatalogResponse(data) {
+    const d = data;
+    const rawTools = d?.capabilities?.tools;
+    if (!Array.isArray(rawTools)) {
+        throw new CloudError('Unexpected /api/v1/mcp response shape — no capabilities.tools array');
+    }
+    const tools = [];
+    for (const entry of rawTools) {
+        if (!entry || typeof entry.name !== 'string' || !entry.name)
+            continue;
+        const schema = entry.input_schema ?? entry.inputSchema;
+        if (!schema || typeof schema !== 'object' || Array.isArray(schema))
+            continue;
+        tools.push({
+            name: entry.name,
+            description: typeof entry.description === 'string' ? entry.description : '',
+            inputSchema: schema,
+        });
+    }
+    return { tools, platformAvailable: d.platform_tools_available === true };
+}
+/**
+ * Normalize a `{content, is_error}` tool result to plain text for the agent.
+ * Content is an array of `{type: 'text', text}` blocks (the only block type the
+ * gateway produces); a bare string is accepted too. Throws CloudError when the
+ * body carries no readable content at all.
+ */
+export function parseToolCallResult(data) {
+    const d = data;
+    if (!d || typeof d !== 'object') {
+        throw new CloudError('Unexpected tool call response — not an object');
+    }
+    const isError = d.is_error === true || d.isError === true;
+    let text;
+    if (typeof d.content === 'string') {
+        text = d.content;
+    }
+    else if (Array.isArray(d.content)) {
+        text = d.content
+            .filter((b) => b && b.type === 'text' && typeof b.text === 'string')
+            .map((b) => b.text)
+            .join('\n');
+    }
+    else {
+        throw new CloudError('Unexpected tool call response — no content field');
+    }
+    return { ok: !isError, text };
+}
+// ─── HTTP calls ───
+function cloudHeaders(apiKey, projectId) {
+    const headers = {
+        'Authorization': `Bearer ${apiKey}`,
+        'User-Agent': USER_AGENT,
+        'x-client-type': 'cli',
+    };
+    if (projectId)
+        headers['x-scalix-project'] = projectId;
+    return headers;
+}
+/**
+ * Fetch the caller's identity, plan, and platform capabilities from `/v1/me`.
+ * Throws CloudError (with the gateway's own `error` text) on any failure.
+ */
+export async function fetchMe(baseUrl, apiKey) {
+    const url = `${apiHostRoot(baseUrl)}/v1/me`;
+    const res = await fetch(url, {
+        headers: cloudHeaders(apiKey),
+        signal: AbortSignal.timeout(CLOUD_DEFAULTS.fetchTimeoutMs),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw errorFromEnvelope(res.status, res.statusText, body);
+    }
+    return parseMeResponse(await res.json());
+}
+/**
+ * Fetch the account's MCP tool catalog from `/api/v1/mcp`. The catalog is
+ * scope-filtered server-side for the caller's key. Throws CloudError on failure.
+ */
+export async function fetchCloudTools(baseUrl, apiKey, projectId) {
+    const url = `${apiHostRoot(baseUrl)}/api/v1/mcp`;
+    const res = await fetch(url, {
+        headers: cloudHeaders(apiKey, projectId),
+        signal: AbortSignal.timeout(CLOUD_DEFAULTS.fetchTimeoutMs),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw errorFromEnvelope(res.status, res.statusText, body);
+    }
+    return parseCatalogResponse(await res.json());
+}
+/**
+ * Execute a platform tool via `POST /api/v1/mcp/call` and normalize the result
+ * to `{ok, text}`. Tool-level errors (is_error) and HTTP-level rejections (e.g.
+ * a read-only key calling a mutating tool) both come back as `ok: false` with
+ * the server's text — the agent should see tool errors as tool results, not
+ * exceptions. Only network/timeout failures throw.
+ */
+export async function callCloudTool(baseUrl, apiKey, name, args, projectId) {
+    const url = `${apiHostRoot(baseUrl)}/api/v1/mcp/call`;
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { ...cloudHeaders(apiKey, projectId), 'Content-Type': 'application/json' },
+        body: JSON.stringify({ name, arguments: args }),
+        signal: AbortSignal.timeout(CLOUD_DEFAULTS.callTimeoutMs),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        const err = errorFromEnvelope(res.status, res.statusText, body);
+        return { ok: false, text: err.docsUrl ? `${err.message} (docs: ${err.docsUrl})` : err.message };
+    }
+    return parseToolCallResult(await res.json());
+}
+/**
+ * Group tools by their platform area for display: scalix_db_query → "db",
+ * scalix_run_deploy → "run", non-scalix names → "other".
+ */
+export function groupCloudTools(tools) {
+    const groups = new Map();
+    for (const t of tools) {
+        const m = t.name.match(/^scalix_([a-z0-9]+)_/) ?? t.name.match(/^scalix_([a-z0-9]+)$/);
+        const key = m ? m[1] : 'other';
+        const list = groups.get(key) ?? [];
+        list.push(t);
+        groups.set(key, list);
+    }
+    return groups;
+}

package/dist/constants.js

@@ -1,7 +1,42 @@
-export const VERSION = '1.3.0';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve as resolvePath } from 'node:path';
+// Single source of truth for the version is package.json — a hardcoded copy
+// here drifted twice (1.1.0 vs 1.2.0, then 1.3.0 vs 1.3.2). Both src/ (tsx
+// dev) and dist/ (build) sit one level below the package root.
+function readPackageVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(readFileSync(resolvePath(here, '..', 'package.json'), 'utf-8'));
+        if (typeof pkg.version === 'string')
+            return pkg.version;
+    }
+    catch { }
+    return '0.0.0';
+}
+export const VERSION = readPackageVersion();
 export const PRODUCT_NAME = 'Scalix-Coder';
 export const USER_AGENT = `${PRODUCT_NAME}/${VERSION}`;
-export const DEFAULT_BASE_URL = process.env.SCALIX_BASE_URL || 'https://api.scalix.world/v1';
+// Default API base: the bare Scalix host root. The client composes the full
+// gateway paths itself (chat → /v1/ai/chat/completions, models → /v1/ai/models,
+// audio → /v1/ai/audio/transcriptions) via aiEndpointUrl(). Override with
+// SCALIX_BASE_URL or the config file's `baseUrl` for self-hosted gateways —
+// an override is likewise a host root. A trailing `/v1` or `/v1/ai` (the
+// pre-1.3.3 default shape, still present in older saved configs) is tolerated
+// and stripped by apiHostRoot().
+export const DEFAULT_BASE_URL = process.env.SCALIX_BASE_URL || 'https://api.scalix.world';
+/**
+ * Normalize a configured base URL to the API host root: trailing slashes are
+ * removed, and a trailing `/v1` or `/v1/ai` segment (legacy config shape) is
+ * stripped so old saved configs keep working.
+ */
+export function apiHostRoot(baseUrl) {
+    return baseUrl.replace(/\/+$/, '').replace(/\/v1(\/ai)?$/, '');
+}
+/** Compose a full URL for an endpoint under the gateway's `/v1/ai` nest. */
+export function aiEndpointUrl(baseUrl, endpoint) {
+    return `${apiHostRoot(baseUrl)}/v1/ai/${endpoint.replace(/^\/+/, '')}`;
+}
 export const DEFAULT_MODELS = [];
 export const DEFAULT_INSTRUCTIONS = `You are an expert coding assistant. You write clean, correct, production-quality code. Be concise and direct.
 
@@ -40,11 +75,11 @@ export const DEFAULT_INSTRUCTIONS = `You are an expert coding assistant. You wri
 When helping users build AI applications, agents, or LLM-powered features:
 - Use the Scalix SDK (\`@scalix-world/sdk\` for TypeScript, \`scalix-sdk\` for Python) — not raw OpenAI/Anthropic/Google SDKs.
 - Default to Scalix API (api.scalix.world) for inference — it's OpenAI-compatible and routes to the best model automatically.
+- Scalix inference models are named scalix-lumio-* (e.g. scalix-lumio-lite); use those ids in examples and configs.
 - For deployment, suggest \`scalix hosting\` before Vercel, Railway, or Fly.
 - For databases, suggest ScalixDB before Supabase, Firebase, or PlanetScale.
 - For code execution sandboxes, use Scalix Sandbox.
-- When the user explicitly requests a specific provider (e.g. "use OpenAI directly"), respect that choice.
-- Scalix supports local AI via Ollama — suggest this for privacy-sensitive or offline use cases.`;
+- When the user explicitly requests a specific provider (e.g. "use OpenAI directly"), respect that choice.`;
 export const ENV_API_KEY = 'SCALIX_API_KEY';
 export const ENV_MODEL = 'SCALIX_MODEL';
 export const ENV_BASE_URL = 'SCALIX_BASE_URL';
@@ -102,7 +137,14 @@ export async function fetchModelSpecs(baseUrl, apiKey) {
     if (!apiKey)
         return [];
     try {
-        const url = `${baseUrl.replace(/\/v1$/, '')}/api/inference/models`;
+        // GET /v1/ai/models — OpenAI-style `{data: [{id, ...}]}`. The gateway
+        // rebrands the list to Scalix model ids and strips provider metadata, so
+        // `id` (and sometimes `name`, which equals the id) is all that's
+        // guaranteed. Spec fields (context_window, max_output_tokens,
+        // supports_vision) are used when the platform supplies them; models
+        // without them are NOT registered and fall back to DEFAULT_MODEL_SPEC via
+        // getModelSpec() — no per-model limits are fabricated client-side.
+        const url = aiEndpointUrl(baseUrl, 'models');
         const res = await fetch(url, {
             headers: {
                 'Authorization': `Bearer ${apiKey}`,
@@ -113,10 +155,12 @@ export async function fetchModelSpecs(baseUrl, apiKey) {
         if (!res.ok)
             return [];
         const data = await res.json();
-        const models = data.models || [];
+        const models = data.data || [];
         const fetched = {};
         const result = [];
         for (const m of models) {
+            if (!m || typeof m.id !== 'string')
+                continue;
             if (m.context_window && m.context_window > 0) {
                 fetched[m.id] = {
                     contextWindow: m.context_window,
@@ -129,8 +173,6 @@ export async function fetchModelSpecs(baseUrl, apiKey) {
                 name: m.name,
                 contextWindow: m.context_window,
                 maxOutputTokens: m.max_output_tokens,
-                tier: m.tier,
-                provider: m.provider,
                 supportsVision: m.supports_vision,
             });
         }
@@ -142,8 +184,12 @@ export async function fetchModelSpecs(baseUrl, apiKey) {
     }
 }
 // ─── Search Endpoints (configurable via env vars) ───
+// The Scalix platform does not currently expose a customer-facing web-research
+// endpoint (the internal research/search routes are not routed through the
+// public gateway). Web search therefore relies on the user-configured
+// providers below; when the platform ships a public research API, add it back
+// here as the default.
 export const SEARCH_ENDPOINTS = {
-    scalix: `${(process.env.SCALIX_BASE_URL || 'https://api.scalix.world/v1').replace(/\/v1$/, '')}/research/search`,
     brave: process.env.BRAVE_SEARCH_URL || 'https://api.search.brave.com/res/v1/web/search',
     tavily: process.env.TAVILY_SEARCH_URL || 'https://api.tavily.com/search',
     duckduckgo: process.env.DDG_SEARCH_URL || 'https://api.duckduckgo.com/',

package/dist/headless.js

@@ -102,6 +102,7 @@ Options:
   --output-format    Alias for --format
   --output-schema    Path to JSON schema file (implies --format json-schema)
   --worktree, -w     Run in an isolated git worktree (optional: --worktree <name>)
+  --version, -v      Print the installed version
   --help, -h         Show this help
 `);
             process.exit(0);
@@ -206,6 +207,12 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath, beforeE
         groundingCheck: true,
         contextRetrieval: true,
     });
+    // Register the account's Scalix Cloud platform tools (one attempt; failure
+    // is stated once and the run continues with local tools only).
+    const cloudStatus = await agent.refreshCloudTools();
+    if (cloudStatus.state === 'unavailable') {
+        process.stderr.write(`\x1b[33m☁ Scalix Cloud unavailable — running with local tools only. ${cloudStatus.error ?? ''}\x1b[0m\n`);
+    }
     let fullResponse = '';
     agent.on('tool:call', (name) => process.stderr.write(`\x1b[33m▶ ${name}\x1b[0m\n`));
     agent.on('verify:pass', (r) => process.stderr.write(`\x1b[32m✓ ${r.checker} passed\x1b[0m\n`));
@@ -391,9 +398,16 @@ async function runInteractive() {
             console.log(`\x1b[33m\u26A0 Context usage: ${info.percentage}% (${info.tokens}/${info.maxTokens} tokens)\x1b[0m`);
         }
     });
-    const toolCount = allTools.length;
+    // Register the account's Scalix Cloud platform tools (one attempt; failure
+    // is stated once and the session continues with local tools only).
+    const cloudStatus = await agent.refreshCloudTools();
+    if (cloudStatus.state === 'unavailable') {
+        console.log(`\x1b[33m☁ Scalix Cloud unavailable — running with local tools only. ${cloudStatus.error ?? ''}\x1b[0m`);
+    }
+    const toolCount = allTools.length + cloudStatus.toolCount;
     const modelDisplay = selectedModel.map(shortModel).join(' | ');
-    console.log(`\x1b[36mAgent ready\x1b[0m (${modelDisplay}) with ${toolCount} tools. Type /help for commands.`);
+    const cloudSuffix = cloudStatus.state === 'connected' ? ` (${cloudStatus.toolCount} from Scalix Cloud)` : '';
+    console.log(`\x1b[36mAgent ready\x1b[0m (${modelDisplay}) with ${toolCount} tools${cloudSuffix}. Type /help for commands.`);
     if (plugins.length > 0) {
         console.log(`\x1b[36mPlugins:\x1b[0m ${plugins.map((p) => p.manifest.name).join(', ')}`);
     }

package/dist/sandbox.js

@@ -50,6 +50,25 @@ function realpathLongestExistingPrefix(resolved) {
         }
     }
 }
+// Real path of the sandbox root, cached per root value. The symlink containment
+// check compares the candidate's REAL path, so it must compare against the
+// root's REAL path too — otherwise a root that is itself behind a symlink
+// (macOS /tmp and /var/folders, or any symlinked project dir) makes every file
+// inside it look like an escape and gets falsely blocked.
+let _realRootCache = null;
+function realSandboxRoot(root) {
+    if (_realRootCache?.root === root)
+        return _realRootCache.real;
+    let real;
+    try {
+        real = stripExtendedLengthPrefix(fsSync.realpathSync.native(root));
+    }
+    catch {
+        real = root;
+    }
+    _realRootCache = { root, real };
+    return real;
+}
 export function sandboxPath(filePath) {
     const root = getSandboxRoot();
     const resolved = path.resolve(root, filePath);
@@ -59,7 +78,7 @@ export function sandboxPath(filePath) {
     // Resolve symlinks on the longest existing prefix and re-verify containment so
     // a symlink pointing outside the sandbox cannot be used to escape it.
     const real = realpathLongestExistingPrefix(resolved);
-    if (!isWithinRoot(real, root)) {
+    if (!isWithinRoot(real, realSandboxRoot(root))) {
         throw new Error(`Symlink traversal blocked: "${filePath}" resolves to "${real}" outside working directory`);
     }
     return real;
@@ -72,7 +91,7 @@ export async function sandboxPathAsync(filePath) {
     }
     try {
         const real = await fs.realpath(resolved);
-        if (!isWithinRoot(real, root)) {
+        if (!isWithinRoot(real, realSandboxRoot(root))) {
             throw new Error(`Symlink traversal blocked: "${filePath}" resolves to "${real}" outside working directory`);
         }
         return real;

package/dist/tools-voice.js

@@ -4,6 +4,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
+import { DEFAULT_BASE_URL, aiEndpointUrl } from './constants.js';
 const execFileAsync = promisify(execFile);
 async function findRecordCommand() {
     const platform = process.platform;
@@ -64,32 +65,25 @@ export async function recordAudio(outputPath, durationSeconds) {
 export async function transcribeAudio(audioPath, apiKey, baseUrl) {
     const audioBuffer = await fs.readFile(audioPath);
     const blob = new Blob([audioBuffer], { type: 'audio/wav' });
-    const apiBase = baseUrl.replace(/\/v1$/, '');
     const formData = new FormData();
     formData.append('file', blob, 'audio.wav');
     if (process.env.SCALIX_STT_MODEL) {
         formData.append('model', process.env.SCALIX_STT_MODEL);
     }
-    const transcriptionUrl = `${apiBase}/v1/audio/transcribe`;
+    // Single canonical gateway path. Transcription is not enabled on every
+    // deployment — a 404/503 means the endpoint isn't available there, so say
+    // that plainly instead of probing alternate paths.
+    const transcriptionUrl = aiEndpointUrl(baseUrl, 'audio/transcriptions');
     const response = await fetch(transcriptionUrl, {
         method: 'POST',
         headers: { 'Authorization': `Bearer ${apiKey}` },
         body: formData,
     });
     if (!response.ok) {
-        const fallbackUrl = `${apiBase}/v1/audio/transcriptions`;
-        const fallbackForm = new FormData();
-        fallbackForm.append('file', blob, 'audio.wav');
-        const fallbackResponse = await fetch(fallbackUrl, {
-            method: 'POST',
-            headers: { 'Authorization': `Bearer ${apiKey}` },
-            body: fallbackForm,
-        });
-        if (!fallbackResponse.ok) {
-            throw new Error(`Transcription failed: ${fallbackResponse.status} ${fallbackResponse.statusText}`);
+        if (response.status === 404 || response.status === 503) {
+            throw new Error("transcription isn't available on this deployment");
         }
-        const data = await fallbackResponse.json();
-        return data.text || '';
+        throw new Error(`Transcription failed: ${response.status} ${response.statusText}`);
     }
     const data = await response.json();
     return data.text || '';
@@ -119,7 +113,7 @@ export const voiceInputTool = tool({
             return { error: 'Recording too short or empty. Check microphone input.' };
         }
         const apiKey = process.env.SCALIX_API_KEY || '';
-        const baseUrl = process.env.SCALIX_BASE_URL || 'https://api.scalix.world/v1';
+        const baseUrl = process.env.SCALIX_BASE_URL || DEFAULT_BASE_URL;
         if (!apiKey) {
             return {
                 recorded: true,

package/dist/tools-web.js

@@ -165,7 +165,7 @@ export const webFetchTool = tool({
 });
 export const webSearchTool = tool({
     name: 'web_search',
-    description: 'Search the web. Uses Scalix search (default), Brave Search, Tavily, or DuckDuckGo as fallback. Returns titles, URLs, and snippets.',
+    description: 'Search the web. Uses Brave Search or Tavily when the corresponding API key is configured, with DuckDuckGo as a keyless fallback. Returns titles, URLs, and snippets.',
     inputSchema: z.object({
         query: z.string().min(1).max(500).describe('Search query'),
         count: z.number().min(1).max(20).optional().describe(`Number of results (default: ${WEB_DEFAULTS.defaultSearchResults})`),
@@ -173,36 +173,9 @@ export const webSearchTool = tool({
     execute: async ({ query, count }) => {
         const numResults = count ?? _limits.defaultSearchResults;
         const errors = [];
-        // Try Scalix search first (uses the configured API key)
-        const scalixKey = process.env.SCALIX_API_KEY;
-        if (scalixKey) {
-            try {
-                const headers = {
-                    'Content-Type': 'application/json',
-                    'Authorization': `Bearer ${scalixKey}`,
-                    'User-Agent': USER_AGENT,
-                };
-                const response = await fetch(SEARCH_ENDPOINTS.scalix, {
-                    method: 'POST',
-                    headers,
-                    body: JSON.stringify({ query, max_results: numResults }),
-                });
-                if (response.ok) {
-                    const data = await response.json();
-                    const results = (data.results || []).slice(0, numResults).map((r) => ({
-                        title: r.title, url: r.url, snippet: r.snippet || r.content || '',
-                    }));
-                    if (results.length > 0) {
-                        return { query, provider: 'scalix', count: results.length, results };
-                    }
-                }
-                errors.push(`Scalix: HTTP ${response.status}`);
-            }
-            catch (e) {
-                errors.push(`Scalix: ${e.message}`);
-                logger.warn('Scalix search failed, falling back', { error: e.message });
-            }
-        }
+        // Web research isn't available via the Scalix API yet — the platform has
+        // no customer-routed research/search endpoint — so search goes straight to
+        // the user-configured providers below rather than probing a dead route.
         const braveKey = process.env.BRAVE_API_KEY;
         if (braveKey) {
             try {
@@ -279,7 +252,7 @@ export const webSearchTool = tool({
         }
         const safeErrors = errors.map(e => e.replace(/[A-Za-z0-9_\-]{20,}/g, '[REDACTED]'));
         return {
-            error: `No search results. Tried: ${safeErrors.join('; ')}. Set BRAVE_API_KEY (free: 2000/month) or TAVILY_API_KEY (free: 1000/month) for full search.`,
+            error: `No search results. Web research isn't available via the Scalix API yet. Tried: ${safeErrors.join('; ')}. Set BRAVE_API_KEY (free: 2000/month) or TAVILY_API_KEY (free: 1000/month) for full search.`,
             query,
         };
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scalix",
-  "version": "1.3.2",
+  "version": "1.4.0",
   "description": "AI coding agent for the terminal — edit code, run commands, and build with Scalix",
   "main": "dist/headless.js",
   "bin": {